From: Peter Maydell Date: Fri, 23 Jun 2023 15:41:35 +0000 (+0100) Subject: target/xtensa: Assert that interrupt level is within bounds X-Git-Tag: qemu-xen-4.20.0~654^2~3 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=ad18376b90c8101;p=qemu-xen.git target/xtensa: Assert that interrupt level is within bounds In handle_interrupt() we use level as an index into the interrupt_vector[] array. This is safe because we have checked it against env->config->nlevel, but Coverity can't see that (and it is only true because each CPU config sets its XCHAL_NUM_INTLEVELS to something less than MAX_NLEVELS), so it complains about a possible array overrun (CID 1507131) Add an assert() which will make Coverity happy and catch the unlikely case of a mis-set XCHAL_NUM_INTLEVELS in future. Signed-off-by: Peter Maydell Acked-by: Max Filippov Message-id: 20230623154135.1930261-1-peter.maydell@linaro.org --- diff --git a/target/xtensa/exc_helper.c b/target/xtensa/exc_helper.c index d4823a65cd..43f6a862de 100644 --- a/target/xtensa/exc_helper.c +++ b/target/xtensa/exc_helper.c @@ -169,6 +169,9 @@ static void handle_interrupt(CPUXtensaState *env) CPUState *cs = env_cpu(env); if (level > 1) { + /* env->config->nlevel check should have ensured this */ + assert(level < sizeof(env->config->interrupt_vector)); + env->sregs[EPC1 + level - 1] = env->pc; env->sregs[EPS2 + level - 2] = env->sregs[PS]; env->sregs[PS] =